Fixed a low-severity SQL injection in the modfunc2 of indexed_search

git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@2814 709f56b5-9817-0410-a4d7-c38de5d9e867

diff --git a/ChangeLog b/ChangeLog
index 99c9ba3..66d04fd 100755 (executable)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2007-12-10  Ingmar Schlecht  <ingmar@typo3.org>
+
+        * (security) Fixed a low-severity SQL injection in the modfunc2 of indexed_search (only exploitable by BE users, and severity limited because addslashes() was already applied to the value - yet not within a quoted string) (Thanks to Henning Pingel for findind the issue and Andreas Otto for the fix)
+
 2007-12-06  Benjamin Mack  <mack@xnos.org>
 
        * (bugfix) Fixed #1678: limit to language; still can delete and move content element (Thanks to Helmut Hummel)

diff --git a/typo3/sysext/indexed_search/modfunc2/class.tx_indexedsearch_modfunc2.php b/typo3/sysext/indexed_search/modfunc2/class.tx_indexedsearch_modfunc2.php
index 6ffad9f..491d908 100644 (file)
--- a/typo3/sysext/indexed_search/modfunc2/class.tx_indexedsearch_modfunc2.php
+++ b/typo3/sysext/indexed_search/modfunc2/class.tx_indexedsearch_modfunc2.php
@@ -86,10 +86,10 @@ class tx_indexedsearch_modfunc2 extends t3lib_extobjbase {
         * @return      string          html table with results
         */
        function showStats()    {
-               global $LANG,$HTTP_GET_VARS,$TYPO3_CONF_VARS;
+               global $LANG, $TYPO3_CONF_VARS;
 
                $conf['words']=50;      // max words in result list
-               $conf['bid']=$HTTP_GET_VARS['id'];      // pageid for several statistics
+               $conf['bid'] = intval(t3lib_div::_GET('id'));   // pageid for several statistics
 
                $addwhere1='';  // all records
                $addwhere2=' AND tstamp > '.(time()-30*24*60*60);       // last 30 days
@@ -123,7 +123,7 @@ class tx_indexedsearch_modfunc2 extends t3lib_extobjbase {
 
                $queryParts['SELECT']= '*, COUNT(*) AS c';
                $queryParts['FROM']='index_stat_word';
-               $queryParts['WHERE']=sprintf('pageid= %s '.$addwhere, $conf['bid']);
+               $queryParts['WHERE']=sprintf('pageid= %d '.$addwhere, $conf['bid']);
                $queryParts['GROUPBY']='word';
                $queryParts['ORDERBY']='c DESC,word';
                $queryParts['LIMIT']=$conf['words'];